CVE-2026-113682 in light-4j
Summary
by MITRE • 10/20/2026
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The light-4j framework, specifically versions ranging from 2.1.5 up to but not including 2.4.0, contains a critical authentication bypass vulnerability within its BasicAuthHandler component. This flaw affects systems relying on Lightweight Directory Access Protocol or Active Directory for user authentication delegation. The core issue stems from an improper validation of credentials during the HTTP basic authentication process. When a client presents a Basic Authorization header containing a known username and an empty password string, the handler fails to reject this request as invalid. Instead, it proceeds to initiate an LDAP bind operation using these provided credentials.
From a technical perspective, the vulnerability arises because the underlying LDAP library or configuration accepts an empty password for certain types of anonymous binds or specific directory configurations that permit unauthenticated access under particular conditions. In standard security practices, basic authentication requires both a username and a non-empty password to establish a secure session. However, in this implementation, the absence of a password does not trigger a rejection mechanism within the light-4j handler before it forwards the request to the LDAP server. Consequently, if the target directory allows anonymous binds or has misconfigured permissions that permit login with empty credentials for specific users, the system incorrectly interprets this as a successful authentication event. This logic error effectively neutralizes the password requirement, allowing an attacker who knows a valid username on the network to bypass access controls entirely.
The operational impact of this vulnerability is severe, particularly in enterprise environments where light-4j serves as the gateway or API handler for sensitive services. An unauthenticated attacker can gain unauthorized access to any functionality protected by basic authentication that delegates to LDAP or Active Directory. This includes accessing internal APIs, retrieving confidential data, modifying user profiles, or executing administrative commands depending on the privileges associated with the targeted username. Since the attack requires only knowledge of a valid username and does not involve brute-forcing passwords or exploiting complex injection flaws, it is highly exploitable in automated attacks. The ease of exploitation significantly increases the risk profile for organizations that have not yet patched their light-4j instances to version 2.4.0 or later.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to adequately verify credentials before granting access. It also maps to MITRE ATT&CK technique T1078, specifically Valid Accounts, where attackers use legitimate account credentials that have been obtained through prior compromise or simple enumeration to bypass security controls. The specific mechanism of using an empty password can be further categorized under CWE-523, Unprotected Transport of Credentials if the basic auth is not used over TLS, although the core issue here is the logical failure in authentication validation rather than transport encryption alone.
To mitigate this risk, organizations must immediately upgrade light-4j to version 2.4.0 or any subsequent release where this logic error has been corrected. The patch ensures that empty passwords are explicitly rejected during the basic authentication phase before any LDAP interaction occurs. Additionally, administrators should review their LDAP and Active Directory configurations to ensure they do not permit anonymous binds unless strictly necessary for specific directory operations, as disabling such permissions adds a layer of defense-in-depth. It is also recommended to enforce strong password policies that prevent empty passwords at the directory level and to monitor authentication logs for unusual patterns involving empty credential fields or high volumes of failed bind attempts associated with known usernames.